CVE-2007-2844

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-05-24 · updated 2026-06-16

Description

PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex, which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access.

Affected products

PHP: 4.0, 4.0-beta_4_patch1, 4.0-beta1, 4.0-beta2, 4.0-beta3, 4.0-beta4 (+67)

References

http://blog.php-security.org/archives/82-Suhosin-0.9.20-and-crypt-Thread-Safety-Vulnerability.html
http://osvdb.org/36088
http://secunia.com/advisories/25434
http://www.securityfocus.com/bid/24109
https://exchange.xforce.ibmcloud.com/vulnerabilities/34601
http://blog.php-security.org/archives/82-Suhosin-0.9.20-and-crypt-Thread-Safety-Vulnerability.html
http://osvdb.org/36088
http://secunia.com/advisories/25434
http://www.securityfocus.com/bid/24109
https://exchange.xforce.ibmcloud.com/vulnerabilities/34601

Get alerted when CVE-2007-2844 or the next vulnerability affects your stack